Multiple Choice
How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?
A) By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.
B) By means of a CRC value of the evidence file itself.
C) By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.
D) By means of an MD5 hash value of the evidence file itself.
Correct Answer:
Verified
Correct Answer:
Verified
Q90: Select the appropriate name for the highlighted
Q91: By default, EnCase will display the data
Q92: What files are reconfigured or deleted by
Q93: A hash set would most accurately be
Q94: The temporary folder of a case cannot
Q96: The following GREP expression was typed in
Q97: You are examining a hard drive that
Q98: In DOS acquisition mode, if a physical
Q99: Within EnCase, what is the purpose of
Q100: A CPU is:<br>A) A chip that would